CV666 Privacy Policy — How We Collect, Use and Protect Your Data
Your privacy matters. This Privacy Policy explains in plain language exactly what personal data CV666 collects from you, why we collect it, how we use it, who we share it with, how long we retain it, and what rights you have over it. We follow GDPR-aligned principles even though Bangladesh does not yet have a comprehensive data protection law equivalent to GDPR — because we believe high data-protection standards are right regardless of legal minimums.
This Privacy Policy applies to all use of cv666.com.bd, our mobile apps and any related communications. By using our services, you consent to the data practices described below.
1. Personal Data We Collect
We collect data in three categories.
Categories of personal data CV666 collects
- Identity data: name, date of birth, NID number, photographs from KYC, gender (optional)
- Contact data: phone number, email address, postal address (only if requested for EDD)
- Account data: username, password (hashed and salted), security questions, IP address, device fingerprint
- Financial data: deposit/withdrawal history, payment method tokens (never raw card numbers), VIP tier
- Behavioural data: games played, bets placed, session lengths, page views, click patterns
- Communications data: support chat transcripts, emails to/from us, WhatsApp messages
2. How We Use Your Data
Your data powers six core functions. First, account management — creating, securing and operating your CV666 account. Second, transaction processing — depositing, wagering, paying winnings. Third, regulatory compliance — KYC, AML, age verification. Fourth, fraud prevention — anti-fraud monitoring on every transaction. Fifth, customer support — answering your questions and resolving issues. Sixth, marketing (only with your explicit opt-in) — informing you of relevant promotions and bonuses.
3. Third Parties We Share Data With
We share the minimum data necessary with carefully vetted third parties. Game providers receive game-session data needed to render gameplay. Payment processors receive transaction data needed to move money. Identity verification providers receive KYC documents needed to verify identity. Cloud infrastructure providers (with strong data-protection terms in their contracts) host our systems. Regulators receive data only where legally compelled. We never sell your data to advertisers or marketing companies — period.
4. Cookies and Similar Technologies
We use cookies for three purposes: essential cookies that make the platform work (cannot be disabled), analytics cookies that help us understand usage patterns (you can opt out), and marketing cookies that personalise promotions (you can opt out). See our dedicated cookie-policy page for full details.
5. Your Privacy Rights
Under our voluntary GDPR-aligned policy, you have the following rights at any time.
Your rights over your personal data
- Right of access — request a copy of all personal data we hold about you
- Right of rectification — correct any inaccurate data we hold
- Right of erasure — request deletion of data, subject to regulatory retention requirements
- Right of portability — receive your data in a machine-readable format
- Right of objection — opt out of marketing or analytics processing
- Right of restriction — temporarily limit how we process your data while disputes are resolved
6. Data Retention
We retain different categories of data for different periods. Account and KYC data: 5 years post-account-closure (regulatory minimum). Transaction data: 5 years post-transaction. Communication data: 2 years from last contact. Behavioural and marketing data: until you opt out or 2 years, whichever is sooner. Anonymised analytics data may be retained indefinitely as it no longer identifies you personally.
7. Data Security
Your data is protected by 256-bit SSL encryption in transit, AES-256 encryption at rest for sensitive categories like KYC, segregated databases with role-based access, immutable access logging, regular external security audits, and a documented incident response process for any breach. We have never had a known breach affecting player data; if we ever do, we commit to notifying affected players within 72 hours per GDPR breach notification timeline.
8. International Data Transfers
Some of our infrastructure (e.g., game provider servers) is located outside Bangladesh. Where data is transferred internationally, we use standard contractual clauses or equivalent legal mechanisms to ensure protection comparable to your home jurisdiction.
9. Children's Privacy
CV666 is strictly 18+. We do not knowingly collect data from anyone under 18. If we discover we have collected data from a minor, we delete it immediately and close any associated account.
10. Contact and Complaints
Privacy questions or rights requests: privacy@cv666.com.bd. Complaints: compliance@cv666.com.bd. We respond to all privacy-related requests within 30 days. If you are unsatisfied with our response, you have the right to escalate to relevant data protection authorities in your jurisdiction.